Xiaomi Home

Is Xiaomi Home safe?

Mostly, if you treat it as a cloud service run by a large Chinese company and set it up with that in mind. Xiaomi Home, still called Mi Home by many owners, controls Xiaomi and Mijia cameras, robot vacuums, lights and sensors, and has more than 50 million installs on Google Play. Xiaomi pays security researchers for bugs in the app, and no regulator has fined or ordered it. The catches are data collection that goes beyond what a smart plug needs, an App Store label that admits tracking, and a camera bug in 2019 that showed some users other people's homes.

We score Xiaomi Home 60/100, level with eufy and below SmartThings at 68. Xiaomi's fitness app, Mi Fitness, scores 64, partly because its App Store label shows no tracking.

What does Xiaomi Home collect?

Apple's privacy label for the iPhone app says identifiers may be used to track you across other companies' apps and websites. It also links location, contact details, user content, identifiers, usage data and "sensitive info" to your identity. Google Play's data safety section is milder: no sharing, with device IDs used for app functions and analytics, and voice recordings and fitness data optional.

The privacy policy, updated on 25 August 2026, explains the gap. To pair devices, Xiaomi collects your Wi-Fi network name and router address, your phone's MAC address and Android ID, and location. Push notifications run through Google, which receives your user ID, OAID, Android ID, MAC address, network details and the list of running app processes, plus the IMEI on phones older than Android 10. Google also runs the user experience programme that gathers usage statistics.

If you pay for the Pro cloud plan with AI recognition of cars, parcels and pets, camera images are uploaded for analysis. Xiaomi says cameras that can recognise these on the device keep the job local. The policy names data centres in India, the Netherlands, Russia and Singapore and says partners in other countries may receive data too. For Europe and the UK, Xiaomi Technology Netherlands is responsible.

The camera bug that showed strangers' homes

In early January 2020 a Xiaomi camera owner in the Netherlands posted stills his Google Nest Hub had shown him from other households, including a sleeping baby and a man asleep in a chair. Xiaomi said a cache update made on 26 December 2019 to improve streaming quality caused the problem under poor network conditions, and that it had found 1,044 users with the Nest Hub integration. Google temporarily disabled Xiaomi integrations on its hubs and Assistant.

It was a single bug in one integration, not a breach of Xiaomi's servers. But it showed what can go wrong when camera images pass through a company's cloud without end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary.

How secure is Xiaomi Home now?

Better than many cheap smart home brands. Xiaomi runs a paid bug bounty on HackerOne with more than 1,200 resolved reports, and the Xiaomi Home Android app and its web services are in scope. Xiaomi accounts support 2-step verification. On its newer cameras, such as the C201, Xiaomi says an MJA1 security chip holds a unique key per device, video is encrypted in transit, and cloud video is encrypted with AES-128.

The app itself has had serious flaws. The US vulnerability database lists an information leak through the app's JavaScript interfaces (CVE-2020-14114, published 2022) and a code execution flaw from improper input validation (CVE-2024-45352, CVSS 8.8, published 2025). Both appear in Xiaomi's own security bulletins. We found no published data breach of Xiaomi Home accounts.

Who regulates it?

No privacy regulator has fined or ordered Xiaomi Home, and we found no published investigation of the app. Xiaomi's other products have drawn scrutiny: Lithuania's cyber security centre reported in 2021 on Xiaomi phones, and the privacy group noyb filed a GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary complaint in Greece in January 2025 over Mi Fitness and data transfers to China. Neither is about this app, so they do not lower its score.

How to use Xiaomi Home more safely

1. Turn on 2-step verification for your Xiaomi account and use a unique password.
2. Put a microSD card in cameras and skip the cloud plan unless you need off-site copies. The free 7-day rolling cloud storage on new cameras runs for three months.
3. Set a sleep schedule or use the lens cover on indoor cameras, and never point them at bedrooms or bathrooms.
4. Leave the user experience programme off if the app offers the choice.
5. Review shared devices and family members in the app after a move or a break-up, and update camera firmware when the app offers it.

How we scored it

The regulatory record (86) is Xiaomi Home's best factor, with no fine or order naming the app. Privacy (45) is its weakest: Apple's label admits tracking, and Google's push service receives a long list of phone identifiers. Security (58) gets credit for a paid bug bounty and encrypted cloud video but loses points for the 2019 camera bug and two high-severity app flaws.